EP3745638A1 - Methods for implementation and obfuscation of a cryptographic algorithm with secret data key - Google Patents

Abstract

The present invention relates to a method of implementing a cryptographic algorithm with a given secret key comprising the execution by data processing means (11a) of an item of equipment (10a) of a code implementing said cryptographic algorithm stored on it. means for storing data (12a) of the equipment (10a), the method being characterized in that at least one so-called obfuscated part of said code parameterized with said secret key uses only a single so-called cmov instruction, which is a conditional displacement instruction in a first operand of the instruction of a second operand of the instruction, at least one occurrence of said cmov instruction in said obfuscated part of the code being dummy.

Description

GENERAL TECHNICAL FIELD

The present invention relates to the field of cryptography, and in particular to a “white box” type encryption / decryption method.

STATE OF THE ART

A function is considered as a “black box” when we cannot access its internal functioning, i.e. we can know its inputs and outputs but not its secret parameters or its intermediate states.

Cryptographic algorithms (for example for encryption or signature) are thus conventionally assumed to be black boxes when their reliability (resistance to attacks) is assessed.

For example, if we take the typical cryptographic algorithms such as DES ("Data Encryption Standard"), 3DES (Triple DES) or AES ("Advanced Encryption Standard"), these work on blocks of a size 64 or 128 bit (and tomorrow 256 bit), but cannot process such a block in a single operation (there are already more than 10 ¹⁹ possible values of 64 bit blocks). It is thus necessary to work within a block on smaller elements, typically of 8 bit size (only 256 possibilities) by chaining non-linear operations with linear operations.

The black box hypothesis in this case assumes that the keys or the intermediate states are inaccessible. This hypothesis imposes a strong constraint on the storage and handling of these parameters. In fact, tools have recently been published to allow the automation of attacks on hardware implementation, so-called auxiliary channel or fault attacks.

Today, for many use cases including mobile payment, it is necessary to deploy cryptographic algorithms by making the fewer assumptions about the security of the target hardware. The secure storage and handling of the secret parameters must then be ensured at the application level.

The so-called white box cryptography aims to meet this challenge by proposing implementations of cryptographic algorithms which are supposed to make the extraction of secrets impossible, even in the event of an attack allowing the attacker full access to the software implementation of the 'algorithm. More precisely, a function is considered a "white box" when its mechanisms are visible. In other words, we make the direct assumption that the attacker has access to everything he wants (the binary is completely visible and modifiable by the attacker and he has full control of the platform of execution). Therefore, the implementation itself is the only line of defense.

The resistance of the products developed is based on a mixture of mathematical principles and software obfuscation. It has for example been proposed to “mask” the internal states by random permutations (unknown but constant) called internal encodings. However, the resistance of protections based solely on mathematical principles does not appear sufficient today, cf. Brecht Wyseur Software Security: White-Box Cryptography. PhD Thesis 2009.

In addition, it has been shown in the articles Joppe W. Bos, Charles Hubain, Wil Michiels, Philippe Teuwen: Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough, CHES2016, Sanfelix, Eloi, Cristofaro Mune, and Job de Haas. “Unboxing the white-box. ” Black Hat EU 2015. 2015, and Jacob, M., Boneh, D., & Felten, E. (2002, November). Attacking an obfuscated cipher by injecting faults. In ACM Workshop on Digital Rights Management (pp. 16-31). Springer, Berlin, Heidelberg, that so-called side-channel or fault-based attacks can be successfully transposed into white box cryptography.

It would therefore be desirable to have a new “white box” cryptography solution using standard mechanisms such as DES and AES which is completely resistant to all known attacks (by channel analysis, fault, etc.).

PRESENTATION OF THE INVENTION

According to a first aspect, the present invention relates to a method for implementing a cryptographic algorithm with a given secret key comprising the execution by data processing means of a device of a code implementing said cryptographic algorithm stored on means for storing data of the equipment, the method being characterized in that at least one so-called obfuscated part of said code parameterized with said secret key uses only a single so-called cmov instruction , which is a conditional movement instruction in a first operand of the instruction of a second operand of the instruction, at least one occurrence of said cmov instruction in said obfuscated part of the code being dummy.

• ladite instruction cmov de déplacement conditionnel dans un premier opérande de l'instruction d'un deuxième opérande de l'instruction met en œuvre :
  • soit, si une condition est vérifiée, le déplacement effectif dans le premier opérande du deuxième opérande ;
  • soit, si ladite condition n'est pas vérifiée, une simulation de déplacement dans le premier opérande du deuxième opérande ;
• ladite occurrence factice de l'instruction cmov étant destinée à mettre en œuvre ladite simulation de déplacement dans le premier opérande du deuxième opérande lors de l'exécution normale dudit code ;
• ladite simulation de déplacement dans le premier opérande du deuxième opérande comprend soit le déplacement effectif dans le premier opérande du premier opérande, soit le déplacement effectif du deuxième opérande ailleurs que dans le premier opérande ;
• chaque instruction cmov de déplacement conditionnel dans un premier opérande de l'instruction d'un deuxième opérande de l'instruction est exprimée à partir d'une instruction dite mov de déplacement non-conditionnel dans le premier opérande du deuxième opérande, encapsulée ;
• les moyens de traitement de données mettent en œuvre un environnement d'exécution sécurisée dans lequel ledit code implémentant ledit algorithme cryptographique est exécuté, tel que l'environnement Secure Guard Extension ;
• ladite partie de code obfusquée comprend une pluralité d'occurrences factices d'instructions cmov pour chaque occurrence réelle d'une instruction cmov ;
• pour un ensemble d'une occurrence réelle et des M-1 occurrences factices correspondantes d'instructions cmov, correspondant à toutes les M valeurs possibles oi d'un objet noté o, dont une valeur attendue r, on a :
  • pour la i-ème occurrence de l'ensemble, la condition de déplacement est « o est égal à oi » ;
  • l'occurence réelle est la j-ième telle que oj=r ;
  • toutes les autres occurrences de l'ensemble sont des occurrences factices ;
• ledit code est dans un langage d'assemblage des moyens de traitement de données ;
• ledit langage d'assemblage est l'assembleur x86 ;
• ledit algorithme cryptographique est un algorithme de chiffrement symétrique, ladite partie obfusquée du code implémentant au moins un tour dudit algorithme de chiffrement symétrique.

According to advantageous and non-limiting characteristics:

• said cmov conditional displacement instruction in a first operand of the instruction of a second operand of the instruction implements:
  • that is, if a condition is verified, the effective displacement in the first operand of the second operand;
  • or, if said condition is not verified, a displacement simulation in the first operand of the second operand;
• said dummy occurrence of the cmov instruction being intended to implement said displacement simulation in the first operand of the second operand during the normal execution of said code;
• said displacement simulation in the first operand of the second operand comprises either the actual displacement in the first operand of the first operand, or the effective displacement of the second operand elsewhere than in the first operand;
• each instruction cmov of conditional displacement in a first operand of the instruction of a second operand of the instruction is expressed on the basis of an instruction called mov of unconditional displacement in the first operand of the second operand, encapsulated;
• the data processing means implement a secure execution environment in which said code implementing said cryptographic algorithm is executed, such as the Secure Guard Extension environment;
• said obfuscated portion of code includes a plurality of dummy instances of cmov instructions for each actual occurrence of a cmov instruction;
• for a set of a real occurrence and the M-1 corresponding dummy occurrences of cmov instructions , corresponding to all the M possible values oi of an object noted o , whose expected value r , we have:
  • for the i-th occurrence of the set, the displacement condition is “ o is equal to oi ”;
  • the real occurrence is the j-th such that oj = r ;
  • all other occurrences of the set are dummy occurrences;
• said code is in an assembly language of the data processing means;
• said assembly language is x86 assembler;
• said cryptographic algorithm is a symmetric encryption algorithm, said obfuscated part of the code implementing at least one turn of said symmetric encryption algorithm.

1. (a) réécriture du premier code en un deuxième code dans lequel au moins une partie dite obfusquée dudit code utilisant ladite clé secrète n'utilise qu'une seule instruction dite mov, qui est une instruction de déplacement non-conditionnelle dans un premier opérande de l'instruction d'un deuxième opérande de l'instruction ;
2. (b) génération d'un troisième code correspondant au deuxième code dans lequel chaque instruction mov de la partie obfusquée est remplacée par une instruction dite cmov, qui est une instruction de déplacement conditionnel dans un premier opérande de l'instruction d'un deuxième opérande de l'instruction, au moins une instruction cmov factice étant ajoutée.

Selon des caractéristiques avantageuses mais non limitatives, le procédé comprend une étape (c) de transmission à l'équipement du troisième pour stockage sur des moyens de stockage d'un équipement en vue de l'exécution par des moyens de traitement de données de l'équipement pour mise en œuvre dudit algorithme cryptographique.According to a second aspect, the invention relates to a method of obfuscating a cryptographic algorithm with a given secret key represented by a first computer code, comprising the implementation by means of data processing of a server of steps of :

1. (a) rewriting the first code into a second code in which at least a so-called obfuscated part of said code using said secret key uses only a single instruction called mov, which is a move instruction unconditional in a first operand of the instruction of a second operand of the instruction;
2. (b) generation of a third code corresponding to the second code in which each mov instruction of the obfuscated part is replaced by a so-called cmov instruction , which is a conditional displacement instruction in a first operand of the instruction of a second operand of the instruction, at least one dummy cmov instruction being added.

According to advantageous but non-limiting characteristics, the method comprises a step (c) of transmission to the equipment of the third for storage on storage means of an item of equipment with a view to execution by data processing means of the. equipment for implementing said cryptographic algorithm.

According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for the execution of a method according to the first aspect or according to the second aspect of implementation or obfuscation of. a cryptographic algorithm with a given secret key; and a storage means readable by a computer equipment on which a computer program product comprises code instructions for the execution of a method according to the first aspect or according to the second aspect of implementing obfuscation of a cryptographic algorithm with given secret key.

PRESENTATION OF FIGURES

• la figure 1 est un schéma d'une architecture pour la mise en œuvre des procédés selon l'invention ;
• la figure 2 illustre un mode de réalisation d'un procédé d'obfuscation selon l'invention.

Other characteristics and advantages of the present invention will emerge on reading the following description of a preferred embodiment. This description will be given with reference to the accompanying drawings in which:

• the figure 1 is a diagram of an architecture for the implementation of the methods according to the invention;
• the figure 2 illustrates an embodiment of an obfuscation method according to the invention.

DETAILED DESCRIPTION Architecture

With reference to the figure 1 , a method of implementing a “white box” cryptographic algorithm implemented within a device 10a such as a mobile terminal (smartphone, touch pad, etc.), ie a device not having particularly secure hardware that can be the object of attacks on hardware implementation, and for which the white box approach is of great interest; as well as a method of obfuscating the cryptographic algorithm allowing this white box implementation.

The equipment 10a comprises data processing means 11a (a processor) and data storage means 12a (a memory, for example flash).

The equipment 10a is for example connected to a server 10b, for example via the internet 20. It may be required to receive from this server 10b (for example that of a security solutions provider) pieces of code (which one will describe below) containing secrets which will be stored in the memory 12a and used for the implementation of the present method The equipment 10a can itself be connected to other servers 10c of third parties with which it can exchange data encrypted using the present method.

Cryptographic process

The method according to the first aspect is a method for implementing a cryptographic algorithm, in particular an “encryption or decryption” method, this means that it makes it possible, depending on the case, to encrypt data. data or decrypt it. It is thus in particular of symmetric type, or “with a secret key”, or of asymmetric type (for example a signature algorithm, for which the third parties have a public key).

It will be understood that the present method is a new implementation of known algorithms, such as 3DES or AES which are the current standards. More precisely, it does not propose a new encryption strategy, but only a new implementation of the algorithm, and thus a new way of handling the data within the algorithm which is resistant to all "white box" attacks. . Thus, the present method conventionally comprising the execution by the data processing means 11a of the equipment 10a of a code implementing in an obfuscated manner (for at least a part of the code called the obfuscated part) said cryptographic function stored on the means data storage 12a. Said code is preferably in a language that can be directly interpreted by the data means 11a, called assembly language. For example, the processors of the x86 family (which constitute the vast majority of processors in use today) recognize an x86 assembly language using an x86 instruction set. In the remainder of the present description, the example of x86 will be taken.

By “obfuscation” is meant here making the computer code “illegible or incomprehensible” in order to generally prevent reverse engineering and in particular to prevent access to the algorithm and its keys. It will be noted that the code of the whole algorithm does not necessarily need to be completely obfuscated in the way which will be described, it suffices in practice for so-called "sensitive" parts to be so, in particular those representative of the parameterized operations. with said secret key, and more particularly those comprising the application of substitution functions. More precisely, according to a conventional diagram, the algorithm implemented processes the data block by block, and within a block it handles elements of a smaller size, for example 16 elements of one byte for a block 128 bits (case of AES for example). These elements are typically handled two by two.

et a avantageusement une taille d'un octet (un « byte » de 8 bits, i.e. k=8).Thus, the present method preferably encrypts or decrypts a data tuple {a _i } _{i <n} with a predetermined secret key tuple {k _i } _{i <n} . Each element a _{i of} said data tuple {a _i } _{i <n} has a value in a space {0; 1} ^k that we will denote ${\mathbb{F}}_2^k$

and advantageously has a size of one byte (an 8-bit “byte”, ie k = 8 ).

To process a complete block from smaller elements, it is necessary to multiply the operations within the block, and for this the present method advantageously comprising in a conventional manner the use of a non-linear substitution function f , combined with the use of a linear multiplexing function L , each given as a function of the cryptographic algorithm to be implemented.

et génère en sortie un élément de sortie de la même taille (i.e. de ${\mathbb{F}}_2^k$

). Ces fonctions sont bien connues, et par exemple dans le cas de DES et AES la fonction f est souvent tabulée et alors appelée boite S (« S-box »).The substitution function f is a function parameterized with a secret key k _i which takes as input an input element of ${\mathbb{F}}_2^k$

and outputs an output element of the same size (i.e. of ${\mathbb{F}}_2^k$

). These functions are well known, and for example in the case of DES and AES the function f is often tabulated and then called box S (“S-box”).

The algorithm typically comprises the alternation of a stage of use of f to permute elements then of a stage of use of L to broadcast the data, until having processed the whole block, it is this is called a round (or "round") of the algorithm. It is thus understood that the present method advantageously comprises the repetition of this so as to encrypt or decrypt a set of data comprising those of said n-tuple {a _i } _{i <n} . The sensitive parts which will be obfuscated in accordance with what will be described can be limited in particular to the first and / or the last turns (for example the first / last three in AES), in other words the applications in the first and / or last rounds of the substitution functions using said secret key.

Note that there are attacks that only target the middle towers, so it is possible to obfuscate the parts corresponding to all the towers if you want to fully protect yourself.

Note also that, protecting only the substitution function is not always sufficient, it may be advantageous to protect sensitive data. through all operations until it depends on too many key bits for an attack to be possible. For example, for AES, this corresponds to going up to the “column mix” of the second round.

Principle of the invention

• soit, si la condition est vérifiée, le déplacement effectif dans le premier opérande du deuxième opérande (i.e. l'instruction mov normale) ;
• soit, si la condition n'est pas vérifiée, une simulation de déplacement dans le premier opérande du deuxième opérande.

L'idée est qu'un attaquant ayant accès au matériel ne puisse pas faire la différence entre les deux branches de l'instruction, i.e. ne puisse pas dire si le déplacement a été effectivement effectué.
La simulation comprend ainsi avantageusement comme un vrai déplacement un accès mémoire et une écriture mémoire, mais naturellement la simulation ne comprend pas le déplacement effectif dans le premier opérande du deuxième opérande.
Notamment, la destination (le premier opérande) sera accédée mais y sera copié son contenu actuel au lieu du deuxième opérande. On peut ainsi d'une certaine façon voir la simulation de déplacement dans le premier opérande du deuxième opérande comme un déplacement dans le premier opérande du premier opérande (ce qui laisse la mémoire en l'état).
Alternativement, la simulation peut comprendre le déplacement vers une autre destination qui ne sera pas utilisée, i.e. voir la simulation de déplacement dans le premier opérande du deuxième opérande comme un déplacement du deuxième opérande ailleurs que dans le premier opérande.The present method is distinguished in that at least one so-called obfuscated part of said code uses only one so-called cmov instruction , which is a conditional displacement instruction in a first operand of the instruction of a second operand of the instruction, at least one occurrence of said cmov instruction in said obfuscated part of the code being dummy.
More precisely, said obfuscated part consists of a plurality of instructions, each being a cmov instruction , ie there are no instructions other than cmov instructions . Of course, two cmov instructions of said part will not be identical, they can have different operands (ie arguments, parameters). We note that each operand can be a register, a memory address, a literal value or a label, and in the typical case it is about two registers so that the displacement consists in the writing of the contents of the register designated by the second operand in the register designated by the first operand.
The cmov instruction of conditional displacement is understood by comparison with a traditional instruction (in particular of the x86 instruction set) called mov of unconditional displacement in the first operand of the second operand of the instruction, ie just displacement.
Indeed, cmov implements the displacement if and only if a condition is verified, whereas mov always implements it. Typically this condition is the value of a boolean called "flag".
Advantageously, the cmov instruction more precisely implements:

• that is, if the condition is verified, the effective displacement in the first operand of the second operand (ie the normal mov instruction);
• or, if the condition is not verified, a displacement simulation in the first operand of the second operand.

The idea is that an attacker having access to the hardware cannot differentiate between the two branches of the instruction, ie cannot say if the move has actually been carried out.
The simulation thus advantageously comprises a memory access and a memory write as a real movement, but naturally the simulation does not include the actual movement in the first operand of the second operand.
In particular, the destination (the first operand) will be accessed but its current content will be copied there instead of the second operand. We can thus in a certain way see the simulation of displacement in the first operand of the second operand as a displacement in the first operand of the first operand (which leaves the memory as it is).
Alternatively, the simulation can include the displacement to another destination which will not be used, ie see the displacement simulation in the first operand of the second operand as a displacement of the second operand elsewhere than in the first operand.

Note that the cmov instruction can either exist natively in the set of instructions recognized by the data processing means (note that this is not the case in the original x86 instruction set, but more versions We note that the original instruction set includes a cmovz instruction for "conditional move if zero" which is conditional but does not have the condition as a parameter: more precisely, the move is performed if a flag of zero ( Zero Flag, ZF) has the value 1), or be obtained by means of a “wrapper” (encapsulation) using the basic instructions. Specifically, a basic mov instruction is wrapped in the wrapper.
In particular, we can for example use the wrapper in original x86 instructions (using the cmovz instruction) following, proposed in the document Ashay Rane, Calvin Lin, Mohit Tiwari: Raccoon: Closing Digital Side-Channels through Obfuscated Execution. USENIX Security Symposium 2015:

The small code size of this wrapper allows each instruction to be thoroughly inspected for possible information leaks. Because the code acts only on the processor registers and never accesses memory, it can operate within a secure area of the processor. The secret condition is loaded into register% 1. The mov instruction on line 4 initializes the destination register with t_val. The test instruction on line 5 checks if pred is zero and updates a zero flag (Zero Flag, ZF), a sign flag (Sign Flag, SF), and a parity flag (Parity Flag, PF) to reflect the comparison. The following cmovz instruction copies the f_val value to the destination register only if pred is zero. At this point, ZF, SF and PF still contain the results of the comparison. The test instruction on line 7 overrides these flags by comparing known non-secret values.

The use of the cmov instruction has been described in the document Adil Ahmad, Byunggill Joe, Yuan Xiao, Yinqian Zhang, Insik Shin, and Byoungyoung Lee, OBFSCURO: A Commodity Obfuscation Engine on Intel SGX, NDSS 2019, to which those skilled in the art may refer (see also Adil Ahmad, Kyungtae Kim, Muhammad Ihsanulhaq Sarfaraz, Byoungyoung Lee: OBLIVIATE: A Data Oblivious Filesystem for Intel SGX. NDSS 2018 ) as a solution to vulnerabilities in the SGX (Secure Guard Extensions) environment.
More specifically, SGX proposes to allocate private memory regions (called secure enclaves), the content of which is protected and inaccessible in reading or writing, including by processes executed at higher privilege levels, ie to have a space where programs can be executed with confidentiality and integrity, in particular, protected from the OS, in order to safely implement sensitive algorithms. We can think of the enclave as a “reverse sandbox”, allowing a more robust black box implementation. In other words, we understand that SGX does not in itself offer any white box protection: the programs that are executed in the enclave are generally written in an ordinary way, with keys and internal states accessible, the protection being ensured by the watertight nature of the enclave.
In addition, this architecture has turned out to be susceptible to attack in many ways, for example by auxiliary channel attacks (leaks, cache attacks, on data access reasons) or by Specter type attacks.
OBLIVIATE / OBFSCURO solutions aim to correct some of these vulnerabilities by adding “obliviousness”, that is to say the fact of not leaving traces (for example the cache) that could be detected by attacks by auxiliary channels. For this, the use of Oblivious RAM type algorithms ( E. Stefanov, M. Van Dijk, E. Shi, C. Fletcher, L. Ren, X. Yu, and S. Devadas, "Path oram: an extremely simple oblivious ram protocol, " in Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS), Berlin, Germany, Oct. 2013 ) allowing to hide accesses to a resource, combined with cmov instructions , is proposed.
OBFSCURO thus manages to prevent certain attacks by auxiliary channels, in this case those by timing or by cache.

However, we note that many other attacks by auxiliary channels remain possible, in particular attacks by consumption, electromagnetic emanations, faults, and in general the attacks possible as soon as one has full access to the equipment.
In other words, if OBFSCURO is effective in the case of cryptographic algorithms implemented on remote equipment such as a server, this is not the case for equipment 10a of the mobile terminal type.

The idea behind the present process is that any computer code can be written ONLY using the cmov instruction , and hence overcome the limitations of OBFSCURO.
Indeed, it has been shown that the (unconditional) mov instruction is Turing-complete, and therefore that we can rewrite any code entirely from the mov instruction .
In particular, there is the M / o / Vfuscator compiler which takes x86 code as input and rewrites it using only the mov instruction . Naturally, the code obtained is unnecessarily long and complex and therefore obfuscated. It is noted that on average the size of the code file is multiplied by 35 by the rewrite.
From there, the same code written this time with cmov instructions instead of mov becomes unassailable, including in the case of accessible hardware and therefore in a white box environment, because each instruction of the code is untraceable due to the conditional character .
Of course, at least one occurrence of said cmov instruction in said obfuscated part of the code must be dummy. The term “dummy” is understood to mean such that the condition is not true during the normal execution of said code, and therefore that the displacement defined by this instruction is not intended to be implemented. We also talk about a decoy instruction in the sense that it is only there to deceive an attacker and not to contribute to the algorithm. In other words, if the movement indicated by this instruction was actually performed, execution would result in an error.

More precisely, suppose that the code can be written with N mov instructions , if only N cmov instructions are used, then the condition is true all the time and none of them simulate a movement. If we use N '> N cmov instructions , then even knowing that there are only N instructions which are really to be implemented, an attacker would not know which they are and could not distinguish them from N'-N > 0 dummy instructions.
In the preferred embodiment where each cmov instruction triggers an actual displacement or a simulation, the dummy instruction is for implementing a displacement simulation in the first operand of the second operand.
In summary, during the execution of the obfuscated part each cmov instruction will be executed, whether real or dummy, but only the execution of the real cmovs will give rise to an effective and correct displacement (the execution of the dummy cmovs giving either a false displacement or an incorrect displacement)

) d'un objet qui sont toutes fausses sauf une. On peut étendre ce principe aux instructions cmov : chaque instruction mov est dupliquée en une pluralité d'instructions cmov dont une « vraie » et le reste factice. En d'autres termes, en supposant que le code puisse être écrit avec N instructions mov et que l'on a M valeurs possibles d'un objet, on utilise NxM instructions cmov dont N instructions réelles et Nx(M-1) factices.
Plus précisément, pour un ensemble d'instructions cmov_i,i<M (cmov_i désignant la i-ème instruction cmov de l'ensemble) « associées » dont une réelle et M-1 factices, correspondant à toutes les M valeurs possibles o_i d'un objet noté o, dont une valeur attendue r, on a :

• pour chaque cmov_i, la condition est « o est égal à o_i » ;
• l'instruction réelle est cmov_j telle que o_j =r ;
• toutes les autres cmov_i (i.e. o_i ≠r) sont des instructions factices.

A ce titre, l'homme du métier pourra utiliser comme wrapper l'un des algorithmes de ce document Emmanuel Prouff, Matthieu Rivain: A Generic Method for Secure SBox Implementation. WISA 2007.
Alternativement ou en complément, pour être sur de pouvoir contrer un adversaire voulant fauter l'exécution, on peut utiliser des techniques de duplications en implémentant des threads d'exécution parallèle des différentes instructions cmov alternatives (réelles ou factices, en particulier d'exécution simultanée des M instructions cmov correspondant aux M différentes valeurs d'un objet), voir le document Oscar Reparaz, Lauren De Meyer, Begül Bilgin, Victor Arribas, Svetla Nikova, Ventzislav Nikov, Nigel P. Smart: CAPA: The Spirit of Beaver Against Physical Attacks. CRYPTO (1) 2018.
En combinant toutes ces techniques d'obfuscation, et en prenant M=2⁸ =256 on note que la taille du code d'origine implémentant l'algorithme cryptographique est typiquement multipliée par au moins 10000. Sachant que chacune des instructions peut être aussi bien réelle que factice, on comprend qu'il n'est plus possible par aucune attaque par canal auxiliaire que ce soit d'identifier d'information exploitable.According to a first embodiment, the obfuscated code can be executed in a secure execution environment such as SGX by using, for example, for each cmov the wrapper as defined above.
If you want a fully white box environment (ie executed in a conventional and non-secure manner on any processor), according to a second embodiment, you can use a wrapper inspired by what is described in the document Emmanuel Prouff, Matthieu Rivain : A Generic Method for Secure SBox Implementation. WISA 2007.
This document proposes an implementation of an S-Box in which we consider all possible values from 0 to 2 ^k - 1 (assuming the S-Box with values in ${\mathbb{F}}_2^k$

) of an object which are all false except one. We can extend this principle to cmov instructions: each mov instruction is duplicated in a plurality of cmov instructions, one of which is “real” and the rest dummy. In other words, assuming the code can be written with N mov and that one has M possible values of an object instructions are used NxM instructions cmov which actual instructions N and Nx (M-1) dummy.
More precisely, for a set of cmov _i instructions _{, i} <M ( cmov _i designating the i-th cmov instruction of the set) “associated” including one real and M-1 dummy, corresponding to all the M possible values o _i of an object denoted o , with an expected value r , we have:

• for each cmov _i , the condition is “ o is equal to o _i ”;
• the actual instruction is cmov _j such that o _j = r ;
• all other cmov _i (ie o _i ≠ r ) are dummy instructions.

As such, a person skilled in the art may use as a wrapper one of the algorithms of this document Emmanuel Prouff, Matthieu Rivain: A Generic Method for Secure SBox Implementation. WISA 2007.
Alternatively or in addition, to be sure to be able to counter an adversary wanting to fault the execution, one can use duplicating techniques by implementing parallel execution threads of the various alternative cmov instructions (real or dummy, in particular simultaneous execution. M cmov instructions corresponding to the M different values of an object), see the document Oscar Reparaz, Lauren De Meyer, Begül Bilgin, Victor Arribas, Svetla Nikova, Ventzislav Nikov, Nigel P. Smart: CAPA: The Spirit of Beaver Against Physical Attacks. CRYPTO (1) 2018.
By combining all these obfuscation techniques, and taking M = 2 ⁸ = 256, we note that the size of the original code implementing the cryptographic algorithm is typically multiplied by at least 10,000. Knowing that each of the instructions can be as well real than fictitious, we understand that it is no longer possible by any attack by auxiliary channel whatsoever to identify exploitable information.

Obfuscation process

According to a second aspect, and with reference to the figure 2 , a method of obfuscating a cryptographic algorithm with a given secret key is proposed represented by a first computer code, ie a method of obtaining said obfuscated code (which will be designated as the third code) for the implementation of the algorithm, in accordance with the first aspect. The first code is typically the assembly language code such as written directly or compiled from a classical programming language, ie unobfused and using various instructions.

This method is typically implemented in a secure manner on the server 10b.

Thus, the data processing means 11b of the server 10b begin with a step (a) of rewriting the first code into a second code in which at least one so-called obfuscated part of said code using said secret key uses only one instruction said mov, which is an unconditional movement instruction in a first operand of the instruction of a second operand of the instruction.

In other words, the original code is turned into mov-only through the use of a tool such as M / o / Vfuscator.

Note that the second code can be directly compiled from a first code which is not in an assembly language.

In a following step (b), a third code is generated corresponding to the second code in which each mov instruction of the obfuscated part is replaced by an instruction called cmov, which is a conditional displacement instruction in a first operand of the instruction d 'a second operand of the instruction. At this point, each cmov instruction is an actual instruction, which is why step (b) includes adding at least one dummy cmov instruction in the third code.

For this, as explained, it is possible to add a plurality of dummy cmov instruction for each real cmov instruction, in particular by duplicating the real cmov instruction as many times as an object can take values.

Finally, the obfuscation method can comprise a step (c) of transmission to the equipment 10a of the third code for storage on storage means 12a of an equipment 10a with a view to execution by data processing means. 11a of the equipment 10a for setting implementation of said cryptographic algorithm, ie the method according to the first aspect.

Computer program product

According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for execution (in particular on the data processing means 11a, 11b of the equipment 10a and / or of the server. 10b) of a method according to the first or second aspect of the invention for implementing or obfuscating a cryptographic algorithm with a given secret key, as well as storage means readable by computer equipment (a memory 12a , 12b of the equipment 10a and / or of the server 10b) on which this computer program product is found.

Claims (14)

Method for implementing a cryptographic algorithm with a given secret key comprising the execution by data processing means (11a) of an item of equipment (10a) of a code implementing said cryptographic algorithm stored on storage means of data (12a) of the equipment (10a), the method being characterized in that at least one so-called obfuscated part of said code parameterized with said secret key uses only a single so-called cmov instruction , which is a move instruction conditional in a first operand of the instruction of a second operand of the instruction, at least one occurrence of said cmov instruction in said obfuscated part of the code being dummy. The method of claim 1, wherein said conditional displacement cmov instruction in a first operand of the instruction of a second operand of the instruction implements: - or, if a condition is verified, the effective displacement in the first operand of the second operand; - or, if said condition is not verified, a displacement simulation in the first operand of the second operand; said dummy occurrence of the cmov instruction being intended to implement said displacement simulation in the first operand of the second operand during the normal execution of said code. The method of claim 2, wherein said simulating displacement in the first operand of the second operand comprises either the actual displacement in the first operand of the first operand or the effective displacement of the second operand elsewhere than in the first operand. Method according to one of claims 1 and 3, wherein each cmov conditional displacement instruction in a first operand of instructing a second operand of the instruction is expressed from a said mov non-conditional move instruction in the first operand from the second operand, encapsulated. Method according to one of claims 1 and 4, wherein the data processing means (11a) implement a secure execution environment in which said code implementing said cryptographic algorithm is executed, such as the Secure Guard Extension environment. . The method of one of claims 1 and 5, wherein said obfuscated portion of code comprises a plurality of dummy instances of cmov instructions for each actual occurrence of a cmov instruction . Method according to Claim 6, in which, for a set of a real occurrence and of the corresponding M-1 dummy occurrences of cmov instructions , corresponding to all the M possible values o _i of an object denoted o , of which an expected value r , we have: - for the i-th occurrence of the set, the displacement condition is “ o is equal to o _i ”; - the real occurrence is the j-th such that o _j = r ; - all the other occurrences of the set are dummy occurrences. Method according to one of claims 1 to 7, wherein said code is in an assembly language of the data processing means (11a). A method according to claim 8, wherein said assembly language is x86 assembler. Method according to one of claims 1 to 9, wherein said cryptographic algorithm is a symmetric encryption algorithm, said obfuscated part of the code implementing at least one turn of said symmetric encryption algorithm. Method of obfuscating a cryptographic algorithm with a given secret key represented by a first computer code, comprising the implementation by means of data processing (11b) of a server (10b) of steps of: (a) rewriting the first code into a second code in which at least a so-called obfuscated part of said code using said secret key uses only a single so-called mov instruction , which is an unconditional displacement instruction in a first operand of instruction of a second operand of the instruction; (b) generation of a third code corresponding to the second code in which each mov instruction of the obfuscated part is replaced by a so-called cmov instruction , which is a conditional displacement instruction in a first operand of the instruction of a second operand of the instruction, at least one dummy cmov instruction being added. Method according to claim 11, comprising a step (c) of transmitting to the equipment (10a) of the third for storage on storage means (12a) of an equipment (10a) with a view to execution by means of processing of data (11a) of the equipment (10a) for implementing said cryptographic algorithm. Computer program product comprising code instructions for executing a method according to one of claims 1 to 12 for implementing or obfuscating a cryptographic algorithm with a given secret key, when said program is executed by a computer. Storage means readable by computer equipment on which a computer program product comprises code instructions for the execution of a method according to one of claims 1 to 12 for setting work or obfuscation of a cryptographic algorithm with a given secret key.

Images